Secret Sharing Schemes for Very Dense Graphs€¦ · Secret Sharing Schemes: Overview Shamir...

SECRET SHARING SCHEMES

FOR

VERY DENSE GRAPHS

AMOS BEIMEL1 ORIOL FARRÀS 2 YUVAL MINTZ1

1Ben-Gurion University of the Negev, Israel2Universitat Rovira i Virgili, Spain

CRYPTO 2012

Program

1 Introduction to Secret Sharing

2 Graph Secret Sharing

3 Our Results

1 Introduction to Secret Sharing

2 Graph Secret Sharing

3 Our Results

Secret Sharing Scheme

A method to protect a secret

Secret Sharing Scheme

A method to protect a secret

Secret

P1 P2 P3 P4 P5

Secret Sharing Scheme

A method to protect a secret

Secret

P1 P2 P3 P4 P5

s1 s2 s3 s4 s5

Secret Sharing Scheme

A method to protect a secret

P1 P2 P3 P4 P5

Secret Sharing Scheme

A method to protect a secret

P1 P2 P3 P4 P5

Secret

Authorized subset

Secret Sharing Scheme

A method to protect a secret

P1 P2 P3 P4 P5

NoInformation

Forbidden subset

Secret Sharing Scheme

A method to protect a secret

P1 P2 P3 P4 P5

Access structure: Family of authorized subsets

Secret Sharing Schemes: Overview

Shamir (’79), Blakley (’79), Ito, Saito, and Nishizeki (’87).

Secret Sharing Schemes: Overview

Shamir (’79), Blakley (’79), Ito, Saito, and Nishizeki (’87).

Unconditionally secure.

Secret Sharing Schemes: Overview

Shamir (’79), Blakley (’79), Ito, Saito, and Nishizeki (’87).

Unconditionally secure.

Perfect schemes: subsets not in the access structure areforbidden.

Secret Sharing Schemes: Overview

Shamir (’79), Blakley (’79), Ito, Saito, and Nishizeki (’87).

Unconditionally secure.

Perfect schemes: subsets not in the access structure areforbidden.

Cryptographic primitive with many applications

Multiparty computation

Threshold cryptography

Access control

Attribute-based encryption

Oblivious transfer

...

Secret Sharing Schemes: Overview

Shamir (’79), Blakley (’79), Ito, Saito, and Nishizeki (’87).

Unconditionally secure.

Perfect schemes: subsets not in the access structure areforbidden.

Cryptographic primitive with many applications

Multiparty computation

Threshold cryptography

Access control

Attribute-based encryption

Oblivious transfer

...

Need of efficient schemes: Shares have to be small.

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

Schemes with total share size n are called ideal.

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

Schemes with total share size n are called ideal.

... but which is the most efficient scheme for an access structure?

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

Schemes with total share size n are called ideal.

... but which is the most efficient scheme for an access structure?

There are methods to construct schemes for every access structure...(Benaloh and Leichter’88, Simmons et al’91, Brickell’89, Karchmer and Wigderson’93)

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

Schemes with total share size n are called ideal.

... but which is the most efficient scheme for an access structure?

There are methods to construct schemes for every access structure...(Benaloh and Leichter’88, Simmons et al’91, Brickell’89, Karchmer and Wigderson’93)

but in general are innefficient.

On the Share Size

As a measure of efficiency we use

total share size:sum size of shares

size of secret=

∑

log |Si |log |S|

There exist efficient schemes for certain access structures.e.g., threshold a.s. with n participants admits schemes with t.s.s. n(Shamir’79, Blakley’79).

Schemes with total share size n are called ideal.

... but which is the most efficient scheme for an access structure?

There are methods to construct schemes for every access structure...(Benaloh and Leichter’88, Simmons et al’91, Brickell’89, Karchmer and Wigderson’93)

but in general are innefficient.

For most access structures, the t.s.s of these schemes is 2O(n).

On the Share Size (II)

In general, the best upper bound on the t.s.s of the best scheme for

an access structure is 2O(n).

On the Share Size (II)

In general, the best upper bound on the t.s.s of the best scheme for

an access structure is 2O(n).

Lower Bounds:

There is a family of access structures for which the t.s.s. of anyscheme is

Ω(n2/ log n)(Csirmaz’97)

This is the best known lower bound for sharing a secret with respectto an access structure.

On the Share Size (II)

In general, the best upper bound on the t.s.s of the best scheme for

an access structure is 2O(n).

Lower Bounds:

There is a family of access structures for which the t.s.s. of anyscheme is

Ω(n2/ log n)(Csirmaz’97)

This is the best known lower bound for sharing a secret with respectto an access structure.

Open Problem: BRIDGE THIS HUGE GAP

Our Results

Open Problem: BRIDGE THE GAP

Our Results

Open Problem: BRIDGE THE GAP

Open problem: Which access structures are HARD?i.e. which access structures require large shares to be realized?

Our Results

Open Problem: BRIDGE THE GAP

Open problem: Which access structures are HARD?i.e. which access structures require large shares to be realized?

We study these problems for GRAPH ACCESS STRUCTURES.

Our Results

Open Problem: BRIDGE THE GAP

Open problem: Which access structures are HARD?i.e. which access structures require large shares to be realized?

We study these problems for GRAPH ACCESS STRUCTURES.

We find new UPPER AND LOWER BOUNDS for the t.s.s.

Our Results

Open Problem: BRIDGE THE GAP

Open problem: Which access structures are HARD?i.e. which access structures require large shares to be realized?

We study these problems for GRAPH ACCESS STRUCTURES.

We find new UPPER AND LOWER BOUNDS for the t.s.s.

We extend the techniques for finding upper bounds to

homogeneous access structures

the general case

1 Introduction to Secret Sharing

2 Graph Secret Sharing

3 Our Results

Graph Secret Sharing

1

2

3

4

5

6

An access structure is agraph access structure if theminimal authorized subsetsare of size two.It defines a graph.

Graph Secret Sharing

1

2

3

4

5

6

An access structure is agraph access structure if theminimal authorized subsetsare of size two.It defines a graph.

1

2A set is authorized ifcontains an edge:

1, 2

Graph Secret Sharing

1

2

3

4

5

6

An access structure is agraph access structure if theminimal authorized subsetsare of size two.It defines a graph.

1

6

5

A set is forbidden if doesnot contain any edge:

1, 5, 6

Graph Secret Sharing

1

2

3

4

5

6

An access structure is agraph access structure if theminimal authorized subsetsare of size two.It defines a graph.

A graph secret sharingscheme is a scheme withgraph access structure.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

1 2

34

Simple construction for anygraph:

The secret s is sharedindependently for every edge.

The total share size is 2m,where m is the number ofedges.

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

1 2

34

Simple construction for anygraph:

The secret s is sharedindependently for every edge.

The total share size is 2m,where m is the number ofedges.

r1

s + r1

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

1 2

34

Simple construction for anygraph:

The secret s is sharedindependently for every edge.

The total share size is 2m,where m is the number ofedges.

r2 s + r2

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

1 2

34

Simple construction for anygraph:

The secret s is sharedindependently for every edge.

The total share size is 2m,where m is the number ofedges.

r3

s + r3

Graph Secret Sharing: Previous Results

Graph secret sharing schemes:

All minimal authorized subsets are of size two.

Simple but interesting case.

Studied in many previous works.

First step for obtaining general results.

1 2

34

Simple construction for anygraph:

The secret s is sharedindependently for every edge.

The total share size is 2m,where m is the number ofedges.

r4

s + r4

Graphs with Ideal Schemes

1 2

3

45

6Clique:It defines threshold accessstructure of threshold 2.

Graphs with Ideal Schemes

1 2

3

45

6Clique:It defines threshold accessstructure of threshold 2.

Complete Bipartite Graph

1

2

3

4

5

6

1 2

3

45

6 7

Star

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Lower bounds:

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Lower bounds:

There exists a family of access structures for which the totalshare size of the schemes realizing them is Ω(n log n)

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Lower bounds:

There exists a family of access structures for which the totalshare size of the schemes realizing them is Ω(n log n)(van Dijk’95, Blundo et al.’97, Csirmaz’05).

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Lower bounds:

There exists a family of access structures for which the totalshare size of the schemes realizing them is Ω(n log n)(van Dijk’95, Blundo et al.’97, Csirmaz’05).

There exists a family of access structures for which the totalshare size of the linear schemes realizing them is Ω(n3/2)

Bounds on the Total Share Size

The total share size of the best scheme realizing a graph accessstructure is upper bounded by

O(m), where m is the number of edges

O(n2/ log n)(Bublitz’86, Blundo et al.’96, Erdös and Pyber’97)

Lower bounds:

There exists a family of access structures for which the totalshare size of the schemes realizing them is Ω(n log n)(van Dijk’95, Blundo et al.’97, Csirmaz’05).

There exists a family of access structures for which the totalshare size of the linear schemes realizing them is Ω(n3/2)(Beimel et al.’97).

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Since the total share size is upper bounded by O(n2/ log n), we try tosolve the following question:

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Since the total share size is upper bounded by O(n2/ log n), we try tosolve the following question:

Is there any graph with total share size Ω(n2/polylogn)?

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Since the total share size is upper bounded by O(n2/ log n), we try tosolve the following question:

Is there any graph with total share size Ω(n2/polylogn)?

Since every graph admits a scheme with total share size 2m, in ahard graph m has to be big.

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Since the total share size is upper bounded by O(n2/ log n), we try tosolve the following question:

Is there any graph with total share size Ω(n2/polylogn)?

Since every graph admits a scheme with total share size 2m, in ahard graph m has to be big.

We study VERY DENSE GRAPHS

Motivation of Our Work

To BRIDGE THE GAP between upper and lower bounds on the totalshare size for graph access structures.

We look for EFFICIENT constructions for graphs.

We look for HARD GRAPHS

Since the total share size is upper bounded by O(n2/ log n), we try tosolve the following question:

Is there any graph with total share size Ω(n2/polylogn)?

Since every graph admits a scheme with total share size 2m, in ahard graph m has to be big.

We study VERY DENSE GRAPHS

i.e. graphs with(n

2

)

− ℓ edges, with ℓ "small".

1 Introduction to Secret Sharing

2 Graph Secret Sharing

3 Our Results

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4 log n).

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n · n1/4+3β/4 log n).

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Direct consequences:

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Direct consequences:

Is there any very dense graph with total share sizeΩ(n2/polylogn)?

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Direct consequences:

Is there any very dense graph with total share sizeΩ(n2/polylogn)? the answer is NO.

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Direct consequences:

Is there any very dense graph with total share sizeΩ(n2/polylogn)? the answer is NO.

in a hard graph, both m and(n

2

)

− m must be big.

Our Main Result

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, thenit admits a scheme with total share size

O(n5/4+3β/4).

Direct consequences:

Is there any very dense graph with total share sizeΩ(n2/polylogn)? the answer is NO.

in a hard graph, both m and(n

2

)

− m must be big.

Main techniques:

Coverings by "easy" graphs: cliques, bipartite graphs and stars.

The probabilistic method.

Colorings of graphs. skip details

Our Main Result (II): Using Coverings

We cover the graph G by using easy graphs:cliques, complete bipartite graphs, and stars.

Our Main Result (II): Using Coverings

We cover the graph G by using easy graphs:cliques, complete bipartite graphs, and stars.

1 2

3

45

6 =

Our Main Result (II): Using Coverings

We cover the graph G by using easy graphs:cliques, complete bipartite graphs, and stars.

1 2

3

45

6 =

1 2

3

45

6 +

1 2

3

45

6

Our Main Result (II): Using Coverings

We cover the graph G by using easy graphs:cliques, complete bipartite graphs, and stars.

1 2

3

45

6 =

1 2

3

45

6 +

1 2

3

45

6

The scheme for G consists on sharing the secret independently forevery piece of the covering.

Our Main Result (II): Using Coverings

We cover the graph G by using easy graphs:cliques, complete bipartite graphs, and stars.

1 2

3

45

6 =

1 2

3

45

6 +

1 2

3

45

6

The scheme for G consists on sharing the secret independently forevery piece of the covering.

We look for small coverings in order to obtain efficient schemes.

Our Main Result (III): A New Technique

We describe the graph G as a clique minus the excluded graph G′

Our Main Result (III): A New Technique

We describe the graph G as a clique minus the excluded graph G′

1 2

3

45

6 =

1 2

3

45

6 −

1 2

3

45

6

Our Main Result (III): A New Technique

We describe the graph G as a clique minus the excluded graph G′

1 2

3

45

6 =

1 2

3

45

6 −

1 2

3

45

6

Each coloring of G′ yields to a subgraph of G.

Our Main Result (III): A New Technique

We describe the graph G as a clique minus the excluded graph G′

1 2

3

45

6 =

1 2

3

45

6 −

1 2

3

45

6

Each coloring of G′ yields to a subgraph of G.

1 2

3

45

6

1 2

3

4

5

6

Our Main Result (III): A New Technique

We describe the graph G as a clique minus the excluded graph G′

1 2

3

45

6 =

1 2

3

45

6 −

1 2

3

45

6

Each coloring of G′ yields to a subgraph of G.

1 2

3

45

6

1 2

3

4

5

6

Taking many random colorings of G′ we end with a covering of G.

Our Main Result (IV): Corollaries

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, then it admits ascheme with total share size

O(n5/4+3β/4).

Our Main Result (IV): Corollaries

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, then it admits ascheme with total share size

O(n5/4+3β/4).

Corollary

If β < 1/3, then it admits a scheme with t.s.s. o(n3/2).

Our Main Result (IV): Corollaries

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, then it admits ascheme with total share size

O(n5/4+3β/4).

Corollary

If β < 1/3, then it admits a scheme with t.s.s. o(n3/2).

Corollary

If a graph has(n

2

)

− ℓ edges,

Our Main Result (IV): Corollaries

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, then it admits ascheme with total share size

O(n5/4+3β/4).

Corollary

If β < 1/3, then it admits a scheme with t.s.s. o(n3/2).

Corollary

If a graph has(n

2

)

− ℓ edges,

and ℓ < n/2, then it admits a scheme with t.s.s. n + O(ℓ5/4).

Our Main Result (IV): Corollaries

Theorem

If a graph has(n

2

)

− n1+β edges for some 0 < β < 1, then it admits ascheme with total share size

O(n5/4+3β/4).

Corollary

If β < 1/3, then it admits a scheme with t.s.s. o(n3/2).

Corollary

If a graph has(n

2

)

− ℓ edges,

and ℓ < n/2, then it admits a scheme with t.s.s. n + O(ℓ5/4).

and ℓ ≪ n4/5, then it admits a scheme with t.s.s. n + o(n).

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

If we add ℓ edges to G, by using the trivial construction we canconstruct a scheme for the new graph with total share size r + 2ℓ.

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

If we add ℓ edges to G, by using the trivial construction we canconstruct a scheme for the new graph with total share size r + 2ℓ.

But what happens if we delete edges from G? .

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

If we add ℓ edges to G, by using the trivial construction we canconstruct a scheme for the new graph with total share size r + 2ℓ.

But what happens if we delete edges from G? NOT KNOWN.

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

If we add ℓ edges to G, by using the trivial construction we canconstruct a scheme for the new graph with total share size r + 2ℓ.

But what happens if we delete edges from G? NOT KNOWN.

Theorem

If we delete ℓ edges from G, the new graph admits a scheme withtotal share size

O(√ℓnr) if ℓ > r/n

r + 2ℓn if ℓ ≤ r/n

Deleting Minimal Authorized Subsets

Let G be a graph. Let Σ be a scheme of t.s.s. r realizing G.

If we add ℓ edges to G, by using the trivial construction we canconstruct a scheme for the new graph with total share size r + 2ℓ.

But what happens if we delete edges from G? NOT KNOWN.

Theorem

If we delete ℓ edges from G, the new graph admits a scheme withtotal share size

O(√ℓnr) if ℓ > r/n

r + 2ℓn if ℓ ≤ r/n

Direct consequence: If G admits an efficient scheme, the graphs thatare close to G are not hard.

Deleting Minimal Authorized Subsets: Generalization

We extend the techniques for graph access structures to

homogeneous access structures

general access structures

go to details

Deleting Minimal Authorized Subsets: Generalization

We extend the techniques for graph access structures to

homogeneous access structures

general access structures

We provide new techniques and constructions, and we give answersto the following problems:

go to details

Deleting Minimal Authorized Subsets: Generalization

We extend the techniques for graph access structures to

homogeneous access structures

general access structures

We provide new techniques and constructions, and we give answersto the following problems:

Deleting minimal authorized subsets in a threshold accessstructure.

go to details

Deleting Minimal Authorized Subsets: Generalization

We extend the techniques for graph access structures to

homogeneous access structures

general access structures

We provide new techniques and constructions, and we give answersto the following problems:

Deleting minimal authorized subsets in a threshold accessstructure.

Deleting minimal authorized subsets in any access structure.

go to details

Lower Bounds

Theorem

For every 2 < ℓ < n, there exists a family of graphs with(n

2

)

− ℓ edgeswhose schemes have t.s.s. at least n + ℓ.

Lower Bounds

Theorem

For every 2 < ℓ < n, there exists a family of graphs with(n

2

)

− ℓ edgeswhose schemes have t.s.s. at least n + ℓ.

There exists a scheme with t.s.s. n + O(ℓ5/4), when 1 < ℓ < n/2.

Lower Bounds

Theorem

For every 2 < ℓ < n, there exists a family of graphs with(n

2

)

− ℓ edgeswhose schemes have t.s.s. at least n + ℓ.

There exists a scheme with t.s.s. n + O(ℓ5/4), when 1 < ℓ < n/2.

Theorem

For every 0 < β < 1, there exists a family of graphs with(n

2

)

− n1+β

edges whose schemes have at least t.s.s. Ω(βn log n).

Lower Bounds

Theorem

For every 2 < ℓ < n, there exists a family of graphs with(n

2

)

− ℓ edgeswhose schemes have t.s.s. at least n + ℓ.

There exists a scheme with t.s.s. n + O(ℓ5/4), when 1 < ℓ < n/2.

Theorem

For every 0 < β < 1, there exists a family of graphs with(n

2

)

− n1+β

edges whose schemes have at least t.s.s. Ω(βn log n).

Theorem

For every 0 < β < 1, there exists a family of graphs with(n

2

)

− n1+β

edges whose linear schemes have at least t.s.s. Ω(n1+β/2).

Lower Bounds

Theorem

For every 2 < ℓ < n, there exists a family of graphs with(n

2

)

− ℓ edgeswhose schemes have t.s.s. at least n + ℓ.

There exists a scheme with t.s.s. n + O(ℓ5/4), when 1 < ℓ < n/2.

Theorem

For every 0 < β < 1, there exists a family of graphs with(n

2

)

− n1+β

edges whose schemes have at least t.s.s. Ω(βn log n).

Theorem

For every 0 < β < 1, there exists a family of graphs with(n

2

)

− n1+β

edges whose linear schemes have at least t.s.s. Ω(n1+β/2).

There exists a scheme with t.s.s. O(n5/4+3β/4) = O(n1+β/2 ·n1/4+β/4).

Summary and Open Directions

Summary:

Secret sharing for very dense graphs.

New upper and lower bounds for the total share size for theschemes realizing these graphs.

Does exit any hard very dense graph?: No.

New techniques for the construction of secret sharing schemes.

Extension to homogeneous and general access structures.

Summary and Open Directions

Summary:

Secret sharing for very dense graphs.

New upper and lower bounds for the total share size for theschemes realizing these graphs.

Does exit any hard very dense graph?: No.

New techniques for the construction of secret sharing schemes.

Extension to homogeneous and general access structures.

Open directions:

To find hard graphs.

New techniques for finding lower bounds on the total share size.

To bridge the gap between upper and lower bounds on the totalshare size.

THANK YOU

Appendix: Deleting Minimal Authorized Subsets

Theorem

Let Γ be a t-threshold access structures for a constant t. If we deleteℓ minimal authorized subsets, then the resulting access structureadmits a scheme with total share size

O(ℓn).

Let Γ be an access structure with a scheme of t.s.s. r such that

if A ∈ min Γ, then |A| ≤ k for some constant k .

Let Γ′ be an access structure such that

min Γ′ = min Γ \∆for every p ∈ P, there is at most d subsets in ∆ containing p.

Theorem

The access structure Γ′ admits a scheme with total share size

O(dk−1r).

go back